---
id: CVE-2026-0810
title: 'Gix-date: gix-date: undefined behavior due to invalid string generation'
summary: >-
  A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function
  can generate strings containing invalid non-UTF8 characters. This issue
  violates the internal safety invariants of the `TimeBuf` component, leading to
  undefine…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-135
vendor: GitoxideLabs
product: gix-date
affected:
  - gix-date < 0.12.0
  - openshift-logging/cluster-logging-operator-bundle
  - openshift-logging/cluster-logging-rhel9-operator
  - openshift-logging/eventrouter-rhel9
  - openshift-logging/fluentd-rhel9
  - openshift-logging/log-file-metric-exporter-rhel9
  - openshift-logging/logging-view-plugin-rhel9
  - openshift-logging/vector-rhel9
  - rust
  - 'rust-toolset:rhel8/rust'
  - rust
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-03-04T19:05:14.997655Z'
exploitAvailable: true
published: '2026-01-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:10:49.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-0810'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-0810'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427057'
    label: RHBZ#2427057
  - url: 'https://crates.io/crates/gix-date'
  - url: 'https://github.com/GitoxideLabs/gitoxide/issues/2305'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0140.html'
tags:
  - cve.org
  - exploit-available
epss: 0.00211
epssPercentile: 0.11435
ingestedAt: '2026-11-05T22:38:31.334Z'
---

## Overview

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.

## Affected

- `gix-date < 0.12.0`
- `openshift-logging/cluster-logging-operator-bundle`
- `openshift-logging/cluster-logging-rhel9-operator`
- `openshift-logging/eventrouter-rhel9`
- `openshift-logging/fluentd-rhel9`
- `openshift-logging/log-file-metric-exporter-rhel9`
- `openshift-logging/logging-view-plugin-rhel9`
- `openshift-logging/vector-rhel9`
- `rust`
- `rust-toolset:rhel8/rust`
- `rust`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.